ICO consultation on the draft updated data 
sharing code of practice 


Qi Does the updated code adequately explain and advise on the new aspects of 
data protection legislation which are relevant to data sharing? 


© ves 
O No 


Q2 If not, please specify where improvements could be made. 


Q3 Does the draft code cover the right issues about data sharing? 
O Yes 
© No 


Q4 If no, what other issues would you like to be covered in it? 


Need more clarity on issues of data sharing with other companies such as social media 
companies or credit reference agencies. This is explained further into this feedback form. 


Q5 Does the draft code contain the right level of detail? 


© Yes 
© No 


Q6 Ifno, in what areas should there be more detail within the draft code? 


Q7 Has the draft code sufficiently addressed new areas or developments in data 


protection that are having an impact on your organisation’s data sharing 
practices? 


© Yes 
O No 


Q8 Ifno, please specify what areas are not being addressed, or not being 
addressed in enough detail. 


Q9 Does the draft code provide enough clarity on good practice in data sharing? 
O Yes 
© No 


Q10 If no, please indicate the section(s) of the draft code which could be improved, 
and what can be done to make the section(s) clearer. 


A particular example would be in relation to data sharing with customer lists and databases. The 
obligations upon the controller are very specific and could be problematic, particularly when data sharing 
with credit reference agencies. The guidance is not very clear specifically around how the source of 
data should be confirmed. Should each controller specifically request confirmation from the other 
controller the source of the data, or would it be sufficient for one controller to receive confirmation from 
the other controller that they know the source of the data, especially as each controller will have their 
own obligations under the legislation? 


Qiii Does the draft code strike the right balance between recognising the benefits of 
sharing data and the need to protect it? 


O Yes 
© No 


Q12 If no, in what way does the draft code fail to strike this balance? 


O13 


Q14 


As explained in Q10. 


Does the draft code cover case studies or data sharing scenarios relevant to 
your organisation? 


O Yes 
© No 


Please provide any further comments or suggestions you may have about the 
draft code. 


would like to see case studies which are more commercial related rather than health or 
children related? For example, social media companies, credit reference agencies? The case 
studies in Annex D of the draft Code does have one study relating to CRAs, but this is more 
to do with transparency rather than data sharing with the CRAs. More clarity around what 
the consequences are if a data sharing agreement is not in place; what would a controller 
need to do in order to comply with the accountability principle? 


Q15 To what extent do you agree that the draft code is clear and easy to 
understand? 


© Strongly agree 

© Agree 

©) Neither agree nor disagree 
© Disagree 

© Strongly disagree 


Q16 Are you answering as: 


O An individual acting in a private capacity (e.g. someone providing their 
views as a member of the public of the public) 


© An individual acting in a professional capacity 
© On behalf of an organisation 
© Other 


Q17 Please specify 
Q18 Please specify 
BMW Group of Companies in the UK 


Q19 Please specify 


Thank you for taking the time to share your views and experience. 


